1BX

private messaging

Five steps

Start here

The five things that happen, in the order they happen. Every step below is something the app does today. Where a part of it has not been measured on a handset, the step says so rather than leaving it out.

Step 1 of 5 · Install

It installs from a link

There is no store listing and no signup on this page. A link installs it, under a cover you pick, and that is the whole distribution.

  • No store. The address you open is the install. Nothing to search for and nothing to review.
  • No signup here. This page collects nothing. There is no form on it.
  • No payment. There is no price and no checkout, because an account and a payment are themselves traces.
Not measured on a phone yetThe install path has not been measured on a handset. Everything this page describes rests on offline tests.
Open the cover picker 1 / 5

Step 2 of 5 · Cover

You choose the name and icon it wears

Each cover is a real, separate installable app with its own name and icon. You choose it when you install, and not afterwards. Two covers can sit on the same phone and the phone treats them as unrelated apps.

  • 40 covers. Weather, Calculator, Notes, Calendar, Timesheet and 35 more, each with its own name, colour and icon.
  • They stay separate. Every cover install carries its own identifier, so installing a second one does not overwrite the first.
  • Chosen at install. The address you install from decides the name the phone shows. The product name appears nowhere in the installed files.
The app says the same thingThe options panel inside the app names the cover this install is and lists the alternatives. It carries no rename control, and explains why: a phone will not let an installed app change its own name, and a button that cannot work is worse than no button. Changing covers leaves two icons on the home screen for a while.
Choose a cover 2 / 5

Step 3 of 5 · Codes

Three codes, and one of them destroys the key

The app opens on a six-digit prompt dressed as two-factor verification. It names neither the product, nor the vault, nor your account.

  • The real code opens the vault. It unwraps the key into memory only, and never writes it back.
  • The decoy code opens a boring notes app. You can add, edit, delete and search notes, and they persist. It destroys nothing.
  • The kill code destroys the key. Instant, silent, and irreversible for you as well.
  • The code is the key, not a password that gets checked. The vault's private key is wrapped with AES-256-GCM under a key derived from your code, and the plaintext copy is deleted at install.
  • A guard instead of a confirmation prompt. Because a wipe has no confirmation step, the kill code must differ from your real code in at least two digits. That rule is enforced while you type.
Honest limitThe codes live in the app's own storage and are not hardware-protected. The key derivation is the protection, not the storage.
3 / 5

Step 4 of 5 · People

You add someone out of band, one at a time

There is no discovery service, and that is deliberate. A lookup of who you know would be the most revealing thing this app could hold, so there is none to query.

  • Keys → Your code. One code carries the install address, your handle and your public key. Opening it adds you.
  • Keys → Add someone takes a code the other person sent you. Nothing is searched for and nothing is looked up.
  • You see the fingerprint before a key is trusted. A substituted key cannot be stored without you acknowledging it.
  • A key handed over by the relay is a claim, not a fact. A claim can never start a silent encrypted send.
  • The banner above the composer always says which kind of send you are about to make — and never hides behind a tap.
Not built, and not neededThe camera step is not built. It does not have to be: your phone's own camera opens a code, with no permission and no add-on.
4 / 5

Step 5 of 5 · Limits

What it will not do

The same list the app carries one tap from Settings. It is here because a limit you learn about after you have relied on it is not a limit, it is a surprise.

  • No notifications, ever. The build carries no push package and declares no notification permission, so there is nothing on a lock screen to read.
  • No account recovery. A lost code has no way back, because an app that could let you back in would be a second door.
  • No proof yet that screenshots are blocked. The block is in the build and has not been read off a handset.
  • No forward secrecy and no key ratchet. If a device key leaks later, messages captured earlier can be read.
  • No iOS version of the lock button. That part is Android only, and the app fails softly rather than pretending.
  • The message path over email is untested. Tests cover the pieces; they do not yet cover a real journey.
Where this list livesThe app carries the same limits one tap from Settings, and its own tests require each one by name — so the screens cannot quietly become more reassuring than the code.
Start: choose a cover 5 / 5

Tell us what broke

If a step here does not match what you saw, that is worth reporting.

Open the feedback form